All Apps and Add-ons

SoS-TA clustered search peer deploy - incorrect scripted input path error

NGRhodes
Explorer

I deployed the SoS-TA package by placing it in on our custer master in /opt/splunk/etc/master-apps directory and deploying from the Web UI.

I noticed the following error after enabling the inputs:

01-08-2015 11:19:08.762 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-sos/bin/ps_sos.sh" /bin/sh: 1: /opt/splunk/etc/apps/TA-sos/bin/ps_sos.sh: not found

The fix
Simply clone the 3 scripted inputs from SoS-TA and recreate the correct path eg:

 /opt/splunk/etc/apps/TA-sos/bin/ps_sos.sh

Becomes:

 /opt/splunk/etc/slave-apps/TA-sos/bin/ps_sos.sh

Have I deployed this incorrectly or is it a bug in the the package deployment mechanism ?

1 Solution

hexx
Splunk Employee
Splunk Employee

This is pretty strange and very unexpected as the S.o.S technology add-on has been specifically validated to work in an indexer cluster environment, deployed from the cluster master just as you described.

Do you maybe have a pre-existing copy of "TA-sos" under $SPLUNK_HOME/etc/apps on the cluster peers? If so, you should remove that version and allow the one under $SPLUNK_HOME/etc/slave-apps to be the only copy of this TA present on the cluster peers.

Don't forget to enable the scripted inputs in $SPLUNK_HOME/etc/master-apps/local/inputs.conf on the Cluster Master before pushing out the TA!

View solution in original post

hexx
Splunk Employee
Splunk Employee

This is pretty strange and very unexpected as the S.o.S technology add-on has been specifically validated to work in an indexer cluster environment, deployed from the cluster master just as you described.

Do you maybe have a pre-existing copy of "TA-sos" under $SPLUNK_HOME/etc/apps on the cluster peers? If so, you should remove that version and allow the one under $SPLUNK_HOME/etc/slave-apps to be the only copy of this TA present on the cluster peers.

Don't forget to enable the scripted inputs in $SPLUNK_HOME/etc/master-apps/local/inputs.conf on the Cluster Master before pushing out the TA!

NGRhodes
Explorer

I did originally copy to the wrong location, looks like there were some leftovers that splunk was picking up 🙂

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...